Users left scrambling for a plan B as Dropbox drops Dropbox Passwords Dropbox has given users of its password manager until the end of October to extract their data before pulling the plug on the service. The discontinuation of Dropbox Passwords will happen in phases. In less than a month, on August 28, Dropbox Passwords will become view-only in both the mobile app and browser extension, and the …
See title. There are a range of compatible clients on PCs and phones so no one can stiff you. The data is on your machine, network shared file or your private cloud. You choose. I use the KeePassXC client on desktops which with CTRL-T on a password lookup gives you the 2FA verification you can just paste into the webpage login box. No separate Authy app require. All free as in beer and otherwise.
Password generator, auto-fill on mobile. Others may add their own favourite features.
I'll add to your recommendation for KeePassXC: https://addons.mozilla.org/en-US/firefox/addon/keepassxc-browser/
For mobile, there's KeePassDX, which is compatible with KeePassXC.
The vault in which you store your credentials is just an encrypted file, so syncing it between devices is as simple as syncing any file.
I have Macs, but I still use Heylogin.
Originally it was Bitwarden but my company now uses it (call me picky, but I like to keep things provably isolated) and I was planning to switch to a full EU based one anyway. And it's handy as I can authorise via any linked Apple device, even a Watch. Also, it's still free for personal use although I wouldn't mind if they charged a sensible amount.
Yes, Apple has a fairly good password management system but I also work on other platforms - things like Bitwarden and Heylogin (et al) bridge that gap.
Ah, but it does. I never enabled iCloud but suddenly found the keychain was being synced. This was even reported on El Reg but I couldn't find the link so here's one from Hacker News.
I see why you'd want to do that, but then you're heading towards password re-use or some algorithm given the sheer volume you need to remember and no, I'm no fan of using SAML resources such as using a Facebook of Google login (that I don't use those doesn't help, obviously :).
If your memory is that good, then all power to you but I'm afraid my braincells have been damaged by too many cat videos :)
password re-use or some algorithm
I never reuse passwords, but do use an algorithmic method for unimportant accounts. Important stuff like bank and investment accounts have unique passwords, and 2FA with a dongle or authenticator. Those I can remember, it just takes some initial effort to memorize them. Then again I don't waste time with social media crap, so perhaps have fewer accounts than the average.
I'm certainly not going to trust the important passwords to some hackable online service (LastPass comes to mind).
I find `openssl rand -base64 $len` quite useful...
No it doesn't contain all the different characters available in unicode, but it makes up for it in length and unpredictability.
Different values of $len will give different length strings, some of which will inevitably end with one or more `=` for padding.
Values of $len and the resultant password length:
25 37; 24 33; 23 33; 22 33; 21 29; 20 29; 19 29; 18 25; 17 25; 16 25; 15 21; 14 21; 13 21; 12 17; 11 17; 10 17;
Genuine question for those who downvoted this. What's the issue?
17-37 characters (depending on $len), 2^6 char selection.
That's 100-200 bits of entropy, and unless openssl has a serious bug (which to be fair the debian sshkeygen issue showed can happen) it's *all* entropy, and no predictability at all.
Absolutely not possible once you decide to move to passwords of a secure length, with a good degree of randomisation. I'm not Derren Brown and have a terrible memory. I fear the day that I forget even the small number of passwords that I use to access machines and password wallets.
Important passwords like that it's perfectly acceptable to print out, seal it in an envelope and put in a safe location.
That could be in a safe somewhere or with another trusted person (for instance I do both of those for a charity keepass file I keep).
Continuity planning is important. Is there anything in there that would be useful in the event that you got hit by a bus?
Pass phrases are easier to remember. But I'm unsure if they are as safe as randomly generated. They're certainly safer than a randomly generated password that is too short.
Though with any password or passphrase, it's ideal to have 2fa. Don't want just 1 layer of protection , or if that service has a leak of passwords, hopefully the hackers can't log in as you because they don't have the 2fa method.
https://security.psu.edu/services/penn-state-accts/passwords/choose/
Recently moved to a new email address as my main one, and as part of that I had to move all my accounts associated with the old email.
To date: found 73 accounts and still have the odd one showing up that I forgot about every couple weeks
I need less accounts, which is really hard since you have to create one for every damn thing you do in life these days...and a password manager.
Use aliases.
I have 5 actual mailboxes (two of which are merely for monitoring), and in the region of about 300+ aliases like amazon.track@ so I can find out who has sold on my data without my permission. Makes it easy to prove (it's rather hard to deny or say 'it wasn't me' if it's literally in the email address) and easy to kill the spam (kill the alias and use a new one)..
Is this your first visit to an IT news website?
Are you lost?
I've got 1,900ish items in my password manager, all (okay most) of them have highly complex passwords. Sure lots of them are probably for websites and resources that are now dead, but there's no way that I would survive as a mobile IT engineer now unless I set all of my passwords as the same word which is
A
REALLY
STUPIDLY
BAD
THING
TO
DO
And you should know this, and you should feel bad for even suggesting it.
Or you're trolling. In which case good work, you made me log in and reply.
I've been using KeyPass for years and storing the password file on Dropbox, then for a while on my own NextCloud, before recently going back to Dropbox. Point being that you are free to store the encrypted file wherever you wish as it's just a file.
I don't know why one would lock oneself into a proprietary system.
I use Password Safe which is also open source and also a good choice. I use cloud storage to store the password db to share it between devices and a very strong passphrase to protect it.
I think choosing KeePass or PWSafe boils down to whether you want flexibility/integration (KeePass) or simple and portable (Password Safe).
"Dropbox has been having a rough time of it lately. The company has subjected staff to several rounds of layoffs, and in October 2024, CEO Drew Houston stated: "We're making more significant cuts in areas where we're over-invested or underperforming."
In calendar 2024, DropBox reported revenue of $2.54 billion, up from $2.5 billion in the prior year. Net income dropped to $452.3 million from $453.6 million. ®"
The sarcasm which is entirely justified here does not quite cover the callousness and lack of attention paid to staff wellbeing or customer satisfaction. The company is making roghly the same as it always was but lets cut staff and drop services so we can grow a few percentage point and make more money for the c suite and share holders.
The advice of others to use Free Open Source Software FOSS solutions like KeePass seems apt as they are paying as much for devs as Dropbox is now and will likely have caused far less trauma.
> It's this obsessive mindset that profits have to *improve* every quarter, as if that is ever going to be sustainable
Sadly, that's the capitalism mantra that is destroying good products (enshitification), and more importantly, destroying our planet :-(
> > It's this obsessive mindset that profits have to *improve* every quarter, as if that is ever going to be sustainable
> Sadly, that's the capitalism mantra that is destroying good products (enshitification), and more importantly, destroying our planet :-(
And every accountant seems to be infected with it. Nor is this limited to the corporate world.
Decades ago I was the treasurer for my local amateur radio club. It was an easy job, just keeping track of income (membership fees) and expenses (club house rent, coffee, activities etc.) and making sure expenses did not exceed income while maintaining a bit of a buffer in the bank account for contingencies. I could easily do that, but not being not much of a bookkeeper I did ask one of our members, who was an accountant, to help me with the year-end financial statement.
Boy, did I get an earful from him about how bad our financial situation was!
What I'd been doing was to take the membership fees that our members had been paying to the club, and use them so that the club could improve the quality of the members' amateur radio hobby (which was the stated purpose of the club). WRONG!!! What I apparently should have been doing instead was to constantly increase our bank balance year-on-year (which was NOT the stated purpose of the club).
Apparently I understand nothing about financial management.
In small amateur groups, it isn't just the financial control. Every decision, no matter how trivial, becomes personal politics. I've given up on a target shooting club and an am-dram group because of the petty, internal bickering. I don't need another 2 hour meeting to discuss why only Brian has sole control over the 2 keys for the shed.
Oh yes indeed!
Nothing brings out the pettiness of adults like a social/sports club. When I was a kid I was a junior in a sports club and it was seeing all the parents, including my own mum and dad , all with their petty bickering at the AGM's and the way the club was run that meant I never, ever wanted to be part of another social club. I once watched a "coup d'état" at the sports club, someone decided spend some money on something and it just exploded! Next thing there was 20 adults in a room at an emergency AGM, arguing and voting each other out of the comittee.
I'm sure some social groups are working fine but it left a very sour taste in my mouth as a kid to see how f**king petty adults can be when they want to be, to the point we kids could see how pathetic and childish they were all acting. I've worked with clubs, even given talks at clubs on subjects but when I've been asked if i wished to join, I've politely refused as I don't need to watch adults acting like children.
I think it's a lesson in working out what your core business is and keeping with it. Dropbox was the pioneer in cloud storage and got nearly everything right. Even now it's significantly better than OneDrive – though which service isn't? I was lucky to be given 1 GB for being at a conference when the announced it and later 10 GB from Samsung. This has, of course, meant I've never really needed to upgrade…
But, apart from syncing stuff between my phone and my computers, I've not really used it much. I have two Google accounts which makes sharing large files easy, though what Google gives, Google can also take away… But I also got 10 GB when I switched my e-mail to Mailbox.org which uses OpenXchange.
But that's a digression – the business market has moved towards fine-grained systems for "data rooms" and from what I can see, Dropbox has not made as much of this market as it could. Everyone should be afraid of Microsoft getting even more market share in this area with its shitty OneDrive / Sharepoint service that they are allowed to force feed customers.
But they should also be happy with their 25% profit margin!
I would never use a FOSS password manager, because the chances of the developers abandoning it are just too high. The FOSS world is littered with projects which died when the developers lost interest or fought amongst themselves and all walked away in an assortment of huffs.
On the other hand, I wouldn't use a commercial password manager for precisely the same reason.
All companies are in it for the money. It's capitalism after all.
However, that doesn't mean you don't have to give a toss about your users, as happy users buy more stuff.
But you're right, it always surprises me that people think individually they're important to a company when they're not.
Never, ever rely on a tech to be there forever. Now a "greybeard" myself after 40 years in the biz, I've seen so much tech thrown out or been dropped, I know all too well that if you buy into a service or tech, always have an escape route, never e 100% depenedent on it 'cos one day the company running it can decide it's just not worth it and bang goes your service and all that subs money you paid in.
Sorry, I can't agree.
It works fine for me (Windows, Linux, Android). However I set it up for my wife who relies on an iPad Pro because her eyesight is (her words) "fucked". And try as I might, I have not been able to get it to integrate with iOS. Everytime an app or website asks for a password, the only option is the ****ing inbuilt iOS one. Despite me performing all the voodoo rituals suggested by BitWarden. You know - the "have you tried" ideas that involve uninstalling the app. Reinstalling it. Doing all the things they tell you to do (that you did) and supplying all the version details and inside leg measurements only for the ticket to fade into a "we'll get back to you".
(For my wife) I need a password manager I can also access via the cloud if I need to login to a site as her.
Then this is a compatibility issue or user error.
Bitwarden iOS has worked for myself and my partner for literally years on a number of generations and types of iOS device (and android and macOS and windows, but that’s not what your comment was about).
It’s cheap (or free if you host your own), open-source, cross-platform and works brilliantly. So let’s add the caveat “if it works for you”, which it does for almost everyone.
Edit: I just looked and there’s just one setting to enable this, Settings->General->Autofill&Passwords. Check Bitwarden and uncheck everything else and it just works. Have you also disabled password management in apps like web browsers etc that might be interfering?
Ditto.
I got an 80 year old father, a wife and a teenage daughter who all need a password stores and I don't need any grief, so 1Password for them. You can't put a price on peace of mind.
I'll happily make my own arrangements for stores but life's too short to spend all day troubleshooting at work and then come home to open up the "Rellies Support Desk" every evening!!!
Plus one for Bitwarden. I needed cheap and cross-platform, specifically android and iOS, and I wanted open-source if possible. Bitwarden satisfied my requirements and has been working well for years for myself and my partner (who is technically illiterate but has transitioned all of her passwords into Bitwarden).
My thought too. When they dropped support about ten years ago for Linux or the then current RHEL version I didn't think they would be around for too much longer. Independently, soon after, the enterprise dropped Dropbox because of rising costs.
For the poor sods still needing access to their personal Dropbox folders we installed rclone which actually worked much more reliably than the defunct official Linux client.
I dropped them when they limited the number of devices you could use on their free tier (pity, as I'd built up a useful block of space through recommendations). But that was before they diversified into passwords and did what a lot of companies do, over-reached their capabilities/resources.
I like Apple's built-in password manager which, as far as I can determine, is fully encrypted and secure. However, I've used a totally separate password manager for around 15 years (covers all platforms) and syncs via a service I choose. It's never failed me and, again as far as I can determine, is secure. It's been reviewed by several reputable groups and its main failings are that it doesn't have a totally free tier, it lacks a few additional facilities like password sharing, has limited browser extensions, and limited enterprise management (none of which matter to me). It's almost never mentioned in comparisons of password managers - which is something I see as a bonus as it helps it fly below the radar of those who like to attack systems. And, in that light, I'm not even going to mention it here.
When Dropbox came out, I had a look and put it on just about all my devices. In particular I made sure that my iPads/iPhones had it, as the Marvin ebook reader used DropBox (and not, repeat, NOT, iCloud, OneDrive, or GoogleDrive) to sync books between devices. If I wanted to have access to various EPUBs, the easy solution was to install DropBox. Then DropBox management restricted the free accounts to three devices. I pulled DropBox from all but three devices (a Mac, a WinBox, and a iPad) and grumbled, but drove on. I did NOT consider going to one of the pay accounts; I might have done so, just to get extra storage (the free account is limited to about 2.5 GB) but the obvious money-grab killed any thought of that. (Hint: it was cheaper to pay for extra storage from Apple than from DropBox… and I could get extra storage from Microsoft for ‘free’, it’’s paid for by the company, not me. Congrats, boys, you ensured that you would NOT be getting a penny from me.) I also noticed that my free DropBox account was slower, a good deal slower, than my Apple or Microsoft or Google accounts; at that time I was using the free Apple iCloud account, I had not yet gone to a paid account, and my Google account is still a free account. Given that while the Apple account is native on Apple devices and the Microsoft account is native on MS devices, the Google account is not native on any device I use (no Android, no Chromebook…) I rather suspect that the speed difference ain’t due to Apple or MS pulling shenanigans; no, the reason why DropBox is slow, and noticeably slower than it used to be, is because DropBox is throttling the free accounts. I used the DropBox account as little as possible, almost always for moving EPUBs to be accessed by Marvin. And once Marvin had the EPUBs, I would delete them from DropBox, so my DropBox storage was almost always empty. Congrats, guys, you made sure that I didn’t use the free storage unless I had to, which made it absolutely certain that I would never use a pay account. Ever.
DropBox is flakey on the Mac and WinBox, as in sometimes it doesn’t load on startup. Sometimes accessing the DropBox app starts it up, other times the only cure is rebooting the device. And Marvin is now dead. So DropBox is unreliable and slow and no longer needed for the primary purpose I had used it for. And I’m waiting for DropBox management to make changes to the TOS, further reducing the number of devices and/or the storage space, or something equally stupid. I never used their password manager because
1. It would have been restricted to the 3 devices I had DropBox on
2. I didn’t trust them and felt that it would be gone sooner rather than later. Oh, look, I was right.
3. Given the way that DropBox was slow and unreliable I had limited confidence in their technical abilities
4. I thought that DropBox management were a pack of wankers. Oh, look, I was right.
If DropBox dies tomorrow I will not shed a tear. If DropBox makes further changes to their services which actually affect me, I will simply kill DropBox on my systems. DropBox management have made it easy, by only allowing three devices, and by throttling the service. Good going, there, guys. Have a sweetie.
So... how many of you actually think that it's a good idea to hand over all your passwords to some arbitrary third party? Seriously? Single point of failure, anyone?
If you're confused, you could try your government's "Top tips for staying secure online", which is, in my case, Viz the National Cyber Security Centre: "A password manager stores passwords safely for you". There, it's official.
You seem to be arguing yourself into a contradiction. You don't want a single point of failure, but you also don't want to share anything? I use KeePassXC, which uses an encrypted, local file store. Something I can securely share amongst my devices, as I see fit.
While that may be true, it all depends on the 3rd party chosen. I use Zoho Vault free edition, and it serves my needs very well. I get an encrypted, password protected backup every day sent to my personal email of all my data, so if something happens with their app and my data I have it as of last night.
Just today (1 Aug 2025) I got a marketing email from Dropbox, suggesting that I might want to upgrade from their Free plan to their Business plan. One of the benefits of upgrading, they said, was
• Safely store and access account login info across all your devices with Dropbox Passwords
I don't think their marketing department has heard the news yet.
